The gate is a static predicate over a JSON document, not a runtime interceptor. `hasWriteStep` walks the recipe and returns true if any step is a click marked `write: true`; when `confirm` is absent, the handler returns an error and never opens the browser [10]. The ordering is the part worth copying. The refusal lands before the browser is provisioned, so there is no window in which a write step has partially executed and then gets caught [12].
That is a different boundary from the one people usually reach for. Sandboxing isolates the process from the host, but the authority here sits elsewhere: in the logged-in session. The author's framing is that handing an agent a real browser session gives it everything the logged-in human can do, including issuing a refund or canceling an order [3]. Filesystem containment does not extend to refund authority.
The arithmetic on the gate is worth spelling out, because it sets the granularity. The check is one boolean AND evaluated once over the whole recipe [9]. Confirmations required per run is therefore one, regardless of how many write clicks the recipe holds: six write-marked clicks and one write-marked click both unlock on the same `confirm: true` [1]. A confirmed mutation costs exactly two requests carrying the identical body, since you resend the same recipe to execute it [2] - the first refused before any browser starts, the second doing the work.
There is a hole in the classification. It is visible in the type union. `goto` is treated as inherently safe, and the author states that the only action which can change state is a click [6][7]. Any mutation reachable by navigating to a URL sits outside the gate by construction [3]. Plenty of dashboards put a confirm-by-link somewhere in the flow.
For this model to transfer to your stack, two things have to be true. Every state change you care about must be behind a click on a selector you enumerated, and recipes have to be reviewed like code, because the flag is a field in a request body rather than a property of the button it points at [19].
The degrade paths are the best engineering in the writeup. With no Anthropic key set, the prompt-based extractor returns the raw text slice instead of failing, so the pipeline still runs in development [15]. When the key is present it calls the Messages API with a Claude Haiku model, asks for JSON only, strips code fences, and parses, and on a parse failure it returns the unparsed text rather than discarding the result [16]. When the BROWSER binding exists but Browser Rendering is over quota or unprovisioned, the launch is wrapped so it becomes a clean error instead of a crash [18]. Three places where the obvious implementation throws and this one hands back something you can inspect.
If I were adopting it, I would start on the extraction path that takes no model at all: a list of `fields` with CSS selectors, scraped directly [14]. A stale selector fails loudly, while a Haiku extraction that drifts one field fails quietly, and quiet failures in a pipeline that also holds a refund button are the ones that cost money.
